avahi-daemon.conf

package: avahi-daemon

title: avahi-daemon.conf(5)

summary: avahi-daemon configuration file

text:
# avahi-daemon.conf(5)

## NAME
avahi-daemon.conf - avahi-daemon configuration file

## SYNOPSIS
/etc/avahi/avahi-daemon.conf

## DESCRIPTION
avahi-daemon.conf is the configuration file for avahi-daemon.

## SECTION [SERVER]
host-name= Set the host name avahi-daemon tries to register on the LAN. If omited defaults to the system host name as set with the sethostname() system call.

host-name-from-machine-id= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will use the machine-id as name on the LAN.

domain-name= Set the default domain name avahi-daemon tries to register its host name and services on the LAN in. If omitted defaults to ".local".

browse-domains= Set a comma separated list of browsing domains (in addition to the default one and those announced inside the default browsing domain). Please note that the user may specify additional browsing domains on the client side, either by setting $AVAHI_BROWSE_DOMAINS to a list of colon separated domains or by adding them to the XDG config file ~/.config/avahi/browse-domains (separated by newlines).

use-ipv4= Takes a boolean value ("yes" or "no"). If set to "no" avahi-daemon will not use IPv4 sockets. Default is "yes".

use-ipv6= Takes a boolean value ("yes" or "no"). If set to "no" avahi-daemon will not use IPv6 sockets. Default is "yes".

allow-interfaces= Set a comma separated list of allowed network interfaces that should be used by the avahi-daemon. Traffic on other interfaces will be ignored. If set to an empty list all local interfaces except loopback and point-to-point will be used.

deny-interfaces= Set a comma separated list of network interfaces that should be ignored by avahi-daemon. Other not specified interfaces will be used, unless allow-interfaces= is set. This option takes precedence over allow-interfaces=.

check-response-ttl= Takes a boolean value ("yes" or "no"). If set to "yes", an additional security check is activated: incoming IP packets will be ignored unless the IP TTL is 255. Earlier mDNS specifications required this check. Since this feature may be incompatible with newer implementations of mDNS it defaults to "no". On the other hand it provides extra security.

use-iff-running= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon monitors the IFF_RUNNING flag bit which is used by some (modern) network drivers to tell user space if a network cable is plugged in (in case of copper ethernet), or the network card is associated with some kind of network (in case of WLAN). If IFF_RUNNING is set avahi-daemon will automatically announce its services on that network. Unfortunately far too many network drivers do not support this flag or support it in a broken way. Therefore this option defaults to "no".

enable-dbus= Takes either "yes", "no" or "warn". If set to "yes" avahi-daemon connects to D-Bus, offering an object oriented client API. It is only available if Avahi has been compiled with --enable-dbus in which case it defaults to "yes". "warn" behaves like "yes", but the daemon starts up even when it fails to connect to a D-Bus daemon. In addition, if the connection to the D-Bus daemon is terminated we try to reconnect. (Unless we are in a chroot() environment where this definitely will fail.)

disallow-other-stacks= Takes a boolean value ("yes" or "no"). If set to "yes" no other process is allowed to bind to UDP port 5353. This effectively impedes other mDNS stacks from running on the host. Use this as a security measure to make sure that only Avahi is responsible for mDNS traffic. Please note that we do not recommend running multiple mDNS stacks on the same host simultaneously. This hampers reliability and is a waste of resources. However, to not annoy people this option defaults to "no".

allow-point-to-point= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will make use of interfaces with the POINTOPOINT flag set. This option defaults to "no" as it might make mDNS unreliable due to usually large latencies with such links and opens a potential security hole by allowing mDNS access from Internet connections. Use with care and YMMV!

cache-entries-max= Takes an unsigned integer specifying how many resource records are cached per interface. Bigger values allow mDNS work correctly in large LANs but also increase memory consumption.

clients-max= Takes an unsigned integer. The maximum number of concurrent D-Bus clients allowed. If the maximum number is reached further clients will be refused until at least one existing client disconnects.

objects-per-client-max= Takes an unsigned integer. The maximum number of objects (entry groups, browsers, resolvers) that may be registered per D-Bus client at a time. If the maximum number is reached further object creation will be refused until at least one object is freed.

entries-per-entry-group-max= Takes an unsigned integer. The maximum number of entries (resource records) per entry group registered by a D-Bus client at a time. If the maximum number is reached further resource records may not be added to an entry group.

ratelimit-interval-usec= Takes an unsigned integer. Sets the per-interface packet rate-limiting interval parameter. Together with ratelimit-burst= this may be used to control the maximum number of packets Avahi will generated in a specific period of time on an interface.

ratelimit-burst= Takes an unsigned integer. Sets the per-interface packet rate-limiting burst parameter. Together with ratelimit-interval-usec= this may be used to control the maximum number of packets Avahi will generated in a specific period of time on an interface.

## SECTION [WIDE-AREA]
enable-wide-area= Takes a boolean value ("yes" or "no"). Enable wide-area DNS-SD, aka DNS-SD over unicast DNS. If this is enabled only domains ending in .local will be resolved on mDNS, all other domains are resolved via unicast DNS. If you want to maintain multiple different multicast DNS domains even with this option enabled we encourage you to use subdomains of .local, such as "kitchen.local". This option defaults to "yes".

## SECTION [PUBLISH]
disable-publishing= Takes a boolean value ("yes" or "no"). If set to "yes", no record will be published by Avahi, not even address records for the local host. Avahi will be started in a querying-only mode. Use this is a security measure. This option defaults to "no"

disable-user-service-publishing= Takes a boolean value ("yes" or "no"). If set to "yes", Avahi will still publish address records and suchlike but will not allow user applications to publish services. Use this is a security measure. This option defaults to "no"

add-service-cookie= Takes a boolean value ("yes" or "no"). If set to "yes" an implicit TXT entry will be added to all locally registered services, containing a cookie value which is chosen randomly on daemon startup. This can be used to detect if two services on two different interfaces/protocols are actually identical. Defaults to "no".

publish-addresses= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will register mDNS address records for all local IP addresses. Unless you want to use avahi-daemon exclusively for browsing it's recommended to enable this. If you plan to register local services you need to enable this option. Defaults to "yes".

publish-hinfo= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will register an mDNS HINFO record on all interfaces which contains information about the local operating system and CPU, which might be useful for administrative purposes. This is recommended by the mDNS specification but not required. For the sake of privacy you might choose to disable this feature. Defaults to "no".

publish-workstation= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will register a service of type "_workstation._tcp" on the local LAN. This might be useful for administrative purposes (i.e. browse for all PCs on the LAN), but is not required or recommended by any specification. Newer MacOS X releases register a service of this type. Defaults to "no".

publish-domain= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will announce the locally used domain name (see above) for browsing by other hosts. Defaults to "yes".

publish-dns-servers= Takes a comma separated list of IP addresses for unicast DNS servers. You can use this to announce unicast DNS servers via mDNS. When used in conjunction with avahi-dnsconfd on the client side this allows DHCP-like configuration of unicast DNS servers.

publish-resolv-conf-dns-servers= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will publish the unicast DNS servers specified in /etc/resolv.conf in addition to those specified with publish-dns-servers. Send avahi-daemon a SIGHUP to have it reload this file. Defaults to "no".

publish-aaaa-on-ipv4= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will publish an IPv6 AAAA record via IPv4, i.e. the local IPv6 addresses can be resolved using an IPv4 transport. Only useful when IPv4 is enabled with use-ipv4=true. Defaults to "yes".

publish-a-on-ipv6= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will publish an IPv4 A record via IPv6, i.e. the local IPv4 addresses can be resolved using an IPv6 transport. Only useful when IPv6 is enabled with use-ipv6=true. Defaults to "no".

## SECTION [REFLECTOR]
enable-reflector= Takes a boolean value ("yes" or "no"). If set to "yes" avahi-daemon will reflect incoming mDNS requests to all local network interfaces, effectively allowing clients to browse mDNS/DNS-SD services on all networks connected to the gateway. The gateway is somewhat intelligent and should work with all kinds of mDNS traffic, though some functionality is lost (specifically the unicast reply bit, which is used rarely anyway). Make sure to not run multiple reflectors between the same networks, this might cause them to play Ping Pong with mDNS packets. Defaults to "no".

reflect-ipv= Takes a boolean value ("yes" or "no"). If set to "yes" and enable-reflector is enabled, avahi-daemon will forward mDNS traffic between IPv4 and IPv6, which is usually not recommended. Defaults to "no".

reflect-filters= Set a comma separated list of allowed service names to be reflected. Each service that is seen must match an entry in this list to be reflected to other networks. This list can match the type of service or the name of the machine providing the service. Defaults to allowing all services.

## SECTION [RLIMITS]
This section is used to define system resource limits for the daemon. See setrlimit(2) for more information. If any of the options is not specified in the configuration file, avahi-daemon does not change it from the system defaults.

rlimit-as= Value in bytes for RLIMIT_AS (maximum size of the process's virtual memory). Sensible values are heavily system dependent.

rlimit-core= Value in bytes for RLIMIT_CORE (maximum core file size). Unless you want to debug avahi-daemon, it is safe to set this to 0.

rlimit-data= Value in bytes for RLIMIT_DATA (maximum size of the process's data segment). Sensible values are heavily system dependent.

rlimit-fsize= Value for RLIMIT_FSIZE (maximum size of files the process may create). Since avahi-daemon shouldn't write any files to disk, it is safe to set this to 0.

rlimit-nofile= Value for RLIMIT_NOFILE (open file descriptors). avahi-daemon shouldn't need more than 15 to 20 open file descriptors concurrently.

rlimit-stack= Value in bytes for RLIMIT_STACK (maximum size of the process stack). Sensible values are heavily system dependent.

rlimit-nproc= Value for RLIMIT_NPROC (max number of processes a user can launch). avahi-daemon forks of a helper process on systems where chroot(2) is available therefore this value should not be set below 2. Note that while the process limit only applies to this process, the total count of processes to reach that limit includes all processes on the system with the same UID, including any containers without UID remapping (such as lxd containers with security.privileged=true). The default configuration of 3 was removed to prevent problems in this scenario.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-daemon(8), avahi-dnsconfd(8)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi.hosts

title: avahi.hosts(5)

summary: avahi-daemon static host name file

text:
# avahi.hosts(5)

## NAME
avahi.hosts - avahi-daemon static host name file

## SYNOPSIS
/etc/avahi/hosts

## DESCRIPTION
/etc/avahi/hosts is a file which may be used to define static host name to IP address mappings for multicast DNS. This is especially useful when publishing DNS-SD services on behalf of other hosts. See avahi.service(5) for more information.

The file format is similar to the one of /etc/hosts: on each line an IP address and the corresponding host name. The host names should be in FQDN form, i.e. with appended .local suffix.

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-daemon(8), avahi.service(5)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avahi.service

title: avahi.service(5)

summary: avahi-daemon static service file

text:
# avahi.service(5)

## NAME
avahi.service - avahi-daemon static service file

## SYNOPSIS
/etc/avahi/services/*.service

## DESCRIPTION
/etc/avahi/services/*.service are XML fragments containing static DNS-SD service data. Every service file can contain multiple service definitions which share the same name. This is useful for publishing service data for services which implement multiple protocols. (i.e. a printer implementing _ipp._tcp and _printer._tcp)

## XML TAGS
<service-group> The document tag of avahi service files. Should contain one <name> and one or more <service> elements.

<name replace-wildcards="yes|no"> The service name. If replace-wildcards is "yes", any occurence of the string "%h" will be replaced by the local host name. This can be used for service names like "Remote Terminal on %h". If replace-wildcards is not specified, defaults to "no".

<service protocol="ipv4|ipv6|any"> Contains the service information for exactly one service type. Should contain one <type> and one <port> element. Optionally it may contain one <domain-name>, one <host-name>, any number of <subtype> and any number of <txt-record> elements. The attribute protocol specifies the protocol to advertise the service on. If any is used (which is the default), the service will be advertised on both IPv4 and IPv6.

<type> Contains the DNS-SD service type for this service. e.g. "_http._tcp".

<subtype> Contains an additional DNS-SD service subtype for this service. e.g. "_anon._sub._ftp._tcp".

<domain-name> The domain name this service should be registered. If omited defaults to the default domain of the avahi daemon. (probably .local)

<host-name> The host name of the host that provides this service. This should be a host that is resolvable by multicast or unicast DNS. Please note that you need to specify a fully-qualified domain name (FQDN) here, i.e. .local is not appended implicitly! The host name doesn't need to be part of the domain specified in <domain-name>. See avahi.hosts(5) for more information how to publish additional host name mappings.

<port> The IP port number the service listens on.

<txt-record value-format="text|binary-hex|binary-base64"> DNS-SD TXT record data. If value-format is "text", the value of the TXT record is taken verbatim. If value-format is "binary-hex" then the value of TXT record is decoded by taking pairs of characters after the "=" char and interpreting them as the textual representation of the two-digit hexadecimal number. Both uppercase and lowercase hexadecimal digits are allowed. The 0x or 0X prefix is not allowed. This requires the length of the value to be even. If value-format is "binary-base64" then the value of TXT record is decoded with a base64 decoder. The character set used is A-Za-z0-9+/. This requires the length of the value to be a multiple of 4, with "=" as padding at the end. If value-format is not specified, defaults to "text". Examples (all the values are decoded to the string "value" without quotes):

<txt-record>key=value<txt-record>

<txt-record value-format="text">key=value<txt-record>

<txt-record value-format="binary-hex">key=76616c7565<txt-record>

<txt-record value-format="binary-base64">key=dmFsdWU=<txt-record>

## AUTHORS
The Avahi Developers <avahi (at) lists (dot) freedesktop (dot) org>; Avahi is available from http://avahi.org/

## SEE ALSO
avahi-daemon(8), avahi.hosts(5)

## COMMENTS
This man page was written using xml2man(1) by Oliver Kurth.


avr-gdbinit

package: avr-gdb

title: avr-gdbinit(5)

summary: GDB initialization scripts

text:
# avr-gdbinit(5)

## NAME
gdbinit - GDB initialization scripts

## SYNOPSIS
~/.gdbinit

./.gdbinit

## DESCRIPTION
These files contain GDB commands to automatically execute during GDB startup. The lines of contents are canned sequences of commands, described in the GDB manual in node "Sequences" -- shell command "info -f gdb -n Sequences".

Please read more in the GDB manual in node "Startup" -- shell command "info -f gdb -n Startup".

(not enabled with "--with-system-gdbinit" during compilation)

System-wide initialization file. It is executed unless user specified GDB option "-nx" or "-n". See more in the GDB manual in node "System-wide configuration" -- shell command "info -f gdb -n 'System-wide configuration'".

~/.gdbinit

User initialization file. It is executed unless user specified GDB options "-nx", "-n" or "-nh".

./.gdbinit

Initialization file for current directory. It may need to be enabled with GDB security command "set auto-load local-gdbinit". See more in the GDB manual in node "Init File in the Current Directory" -- shell command "info -f gdb -n 'Init File in the Current Directory'".

## SEE ALSO
gdb(1), "info -f gdb -n Startup"

The full documentation for GDB is maintained as a Texinfo manual. If the "info" and "gdb" programs and GDB's Texinfo documentation are properly installed at your site, the command

```
        info gdb
```

should give you access to the complete manual.

Using GDB: A Guide to the GNU Source-Level Debugger, Richard M. Stallman and Roland H. Pesch, July 1991.

## COPYRIGHT
Copyright (c) 1988-2018 Free Software Foundation, Inc.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with the Invariant Sections being "Free Software" and "Free Software Needs Free Documentation", with the Front-Cover Texts being "A GNU Manual," and with the Back-Cover Texts as in (a) below.

(a) The FSF's Back-Cover Text is: "You are free to copy and modify this GNU Manual. Buying copies from GNU Press supports the FSF in developing GNU and promoting software freedom."


awesomerc

package: awesome

title: awesomerc(5)

text:
# awesomerc(5)

## NAME
awesomerc - Configuration file for the awesome window manager

## SYNOPSIS
awesome looks for a configuration file in this order:

•$XDG_CONFIG_HOME/awesome/rc.lua

•$HOME/.config/awesome/rc.lua

•$XDG_CONFIG_DIRS/awesome/rc.lua

## DESCRIPTION
The rc.lua file contains configuration information for awesome. It can be used to configure the behavior and look of awesome in a variety of ways. It can be assimilated as a Lua program/script run at startup by awesome. Therefore, it should use the awesome Lua API described in the API section. This file is read at startup.

## AWESOME LUA API
Documentation for the Lua API can be found in the luadoc directory.

## COLORS FORMAT
The color format in awesome is either a standard X color name (blue, darkblue, lightred, etc) or a hexadecimal formatted color (#rrggbb or #rrggbbaa). By using the hexadecimal format, you can also specify an alpha channel: that means that #00ff00 will draw pure green, but #00ff00aa will set the alpha channel to ‘aa’ and will blend the green with the color under it.

## TEXT FORMAT
You can use Pango markup in a text string. This allows formatting the text rendered inside widgets. Pango markup documentation can be found in the Pango documentation at <http://library.gnome.org/devel/pango/stable/PangoMarkupFormat.html>.

A Pango markup example: ....

## SEE ALSO
awesome(1) awesome-client(1)

## AUTHORS
Written by Julien Danjou < <julien@danjou.info>>.

## WWW
<https://awesomewm.org>


backup.d

package: backupninja

title: backup.d(5)

text:
# backup.d(5)

## NAME
BACKUP.D - Action configuration files for backupninja(1).

## SYNOPSIS
/etc/backup.d/*

## DESCRIPTION
To preform the actual backup actions, backupninja processes each action configuration file in /etc/backup.d according to the file's suffix.

.sh

run this file as a shell script.

.rdiff

backup action for rdiff-backup.

.restic

backup action for restic.

.dup

backup action for duplicity.

.borg

backup action for borgbackup.

.maildir

backup action for slow, incremental rsyncs of tens of thousands of maildirs.

.mysql

backup action for safe MySQL dumps.

.pgsql

backup action for safe PostgreSQL dumps.

.sys

backup action for general system reports and hardware information.

.svn

backup action for safe backups of subversion repositories.

.trac

backup action for safe backups of trac repositories.

.makecd

backup action for burning backups to CD/DVD or creating ISOs.

These files must be owned by root and must not be world or group readable/writable. Support for additional configuration types can be added by dropping bash scripts with the name of the suffix into /usr/share/backupninja.

The configuration files are processed in alphabetical order. However, it is suggested that you name the config files in "sysvinit style."

For example:

10-local.pgsql.disabled

15-runthisfirst.sh

20-runthisnext.mysql

90-runthislast.rdiff

Typically, you will put a '.rdiff' config file last, so that any database dumps you make are included in the filesystem backup. Action configurations which end with .disabled are skipped.

Example templates for the action configuration files can be found in /usr/share/doc/backupninja/examples. You can also use ninjahelper(1), a console based "wizard" for creating backup actions.

## SCHEDULING
By default, each configuration file is processed everyday at 01:00 (1 AM). This can be changed by specifying the 'when' option in a backup action's config file or in the global configuration file. Special value 'manual' will disable scheduling for the backup action. It is possible to run the backup action manually by invoking ninjahelper(1) with --run command line argument.

For example:

when = sundays at 02:00

when = 30th at 22

when = 30 at 22:00

when = everyday at 01

when = Tuesday at 05:00

when = hourly

when = manual

These values for "when" are invalid:

when = tuesday at 2am

when = tuesday at 2

when = tues at 02

A configuration file will be processed at the time(s) specified by the "when" option. If multiple "when" options are present, then they all apply. If two configurations files are scheduled to run in the same hour, then we fall back on the alphabetical ordering specified above. The "when" must occur before any sections in the action configuration file.

## FILE FORMAT
The file format of the action configuration files is "ini style." Sections are created by using square bracket. Long lines are connected with a backslash. For example:

\# this is a comment

[fishes]

fish = red

fish = blue

[fruit]

apple = yes

pear = no thanks \

i will not have a pear.

## SEE ALSO
backupninja(1), ninjahelper(1), backupninja.conf(5),

## AUTHOR
BACKUPNINJA was written by the riseup.net collective.


backupninja.conf

title: backupninja.conf(5)

text:
# backupninja.conf(5)

## NAME
BACKUPNINJA.CONF - Configuration file(s) for backupninja (1).

## SYNOPSIS
/etc/backupninja.conf

## DESCRIPTION
backupninja.conf is the general configuration file. In this file you can set the log level and change the default directory locations. You can force a different general configuration file with "backupninja -f /path/to/conf".

## OPTIONS
loglevel

How verbose to make the logs.

5 = Debugging messages

4 = Informational messages

3 = Warnings

2 = Errors

1 = Fatal errors

reportemail

Send a summary of the backup status to this email address.

reportsuccess

If set to 'yes', a report email will be generated even if all modules reported success.

reportinfo

If set to 'yes', info messages from handlers will be sent into the email.

reportwarning

If set to 'yes', a report email will be generated even if there was no error.

reportspace

If set to 'yes', disk space usage will be included in the backup email report.

reporthost

Where to rsync the backupninja.log to be aggregated in a ninjareport.

reportuser

What user to connect to reporthost to sync the backupninja.log

reportdirectory

Where on the reporthost should the report go.

reportwrap

Number of columns the email report body should wrap to.

logfile

The path of the logfile.

configdirectory

The directory where all the backup action configuration files live.

admingroup

Administration user group that is allowed to read/write configuration files in configdirectory.

scriptdirectory

Where backupninja handler scripts are found.

usecolors

If set to 'yes', use colors in the log file and debug output.

when

When to process each configuration file. The value used here will be applied for each configuration file. It is possible to override this "when" in each configuration file, see also section "Scheduling" in backup.d(5). For example:

when = sundays at 02:00

when = 30th at 22

when = 30 at 22:00

when = everyday at 01 <-- the default

when = Tuesday at 05:00

These values for 'when' are equivalent:

when = tuesday at 05:30

when = TUESDAYS at 05

These values for 'when' are invalid:

when = tuesday at 2am

when = tuesday at 2

when = tues at 02

## DEFAULTS
loglevel = 4

reportemail = root

reportsuccess = yes

reportinfo = no

reportspace = no

reporthost =

reportuser = ninja

reportdirectory = /var/lib/backupninja/reports

reportwrap = 1000

logfile = /var/log/backupninja.log

configdirectory = /etc/backup.d

admingroup = root

scriptdirectory = /usr/share/backupninja

usecolors = yes

when = everyday at 01:00

## SEE ALSO
backupninja(1), ninjahelper(1), backup.d(5),

## AUTHOR
BACKUPNINJA was written by the riseup.net collective.


barman

package: barman

title: barman(5)

text:
# barman(5)

## NAME
barman - Backup and Recovery Manager for PostgreSQL

## DESCRIPTION
Barman is an administration tool for disaster recovery of PostgreSQL servers written in Python and maintained by 2ndQuadrant. Barman can perform remote backups of multiple servers in business critical environments and helps DBAs during the recovery phase.

## CONFIGURATION FILE LOCATIONS
The system-level Barman configuration file is located at

```
/etc/barman.conf

```

or

```
/etc/barman/barman.conf

```

and is overridden on a per-user level by

```
$HOME/.barman.conf

```

## CONFIGURATION FILE SYNTAX
The Barman configuration file is a plain INI file. There is a general section called [barman] and a section [servername] for each server you want to backup. Rows starting with ; are comments.

## CONFIGURATION FILE DIRECTORY
Barman supports the inclusion of multiple configuration files, through the configuration_files_directory option. Included files must contain only server specifications, not global configurations. If the value of configuration_files_directory is a directory, Barman reads all files with .conf extension that exist in that folder. For example, if you set it to /etc/barman.d, you can specify your PostgreSQL servers placing each section in a separate .conf file inside the /etc/barman.d folder.

## OPTIONS
active

When set to true (default), the server is in full operational state. When set to false, the server can be used for diagnostics, but any operational command such as backup execution or WAL archiving is temporarily disabled. Setting active=false is a good practice when adding a new node to Barman. Server.

archiver

This option allows you to activate log file shipping through PostgreSQL's archive_command for a server. If set to true (default), Barman expects that continuous archiving for a server is in place and will activate checks as well as management (including compression) of WAL files that Postgres deposits in the incoming directory. Setting it to false, will disable standard continuous archiving for a server. Global/Server.

archiver_batch_size

This option allows you to activate batch processing of WAL files for the archiver process, by setting it to a value > 0. Otherwise, the traditional unlimited processing of the WAL queue is enabled. When batch processing is activated, the archive-wal process would limit itself to maximum archiver_batch_size WAL segments per single run. Integer. Global/Server.

backup_directory

Directory where backup data for a server will be placed. Server.

backup_method

Configure the method barman used for backup execution. If set to rsync (default), barman will execute backup using the rsync command over SSH (requires ssh_command). If set to postgres barman will use the pg_basebackup command to execute the backup. If set to local-rsync, barman will assume to be running on the same server as the the PostgreSQL instance and with the same user, then execute rsync for the file system copy. Global/Server.

backup_options

This option allows you to control the way Barman interacts with PostgreSQL for backups. It is a comma-separated list of values that accepts the following options:

•

exclusive_backup (default when backup_method = rsync): barman backup executes backup operations using the standard exclusive backup approach (technically through pg_start_backup and pg_stop_backup)

•

concurrent_backup (default when backup_method = postgres): if using PostgreSQL 9.2, 9.3, 9.4, and 9.5, Barman requires the pgespresso module to be installed on the PostgreSQL server and can be used to perform a backup from a standby server. Starting from PostgreSQL 9.6, Barman uses the new PostgreSQL API to perform backups from a standby server.

•

external_configuration: if present, any warning regarding external configuration files is suppressed during the execution of a backup.

Note that exclusive_backup and concurrent_backup are mutually exclusive. Global/Server.

bandwidth_limit

This option allows you to specify a maximum transfer rate in kilobytes per second. A value of zero specifies no limit (default). Global/Server.

barman_home

Main data directory for Barman. Global.

barman_lock_directory

Directory for locks. Default: %(barman_home)s. Global.

basebackup_retry_sleep

Number of seconds of wait after a failed copy, before retrying Used during both backup and recovery operations. Positive integer, default 30. Global/Server.

basebackup_retry_times

Number of retries of base backup copy, after an error. Used during both backup and recovery operations. Positive integer, default 0. Global/Server.

basebackups_directory

Directory where base backups will be placed. Server.

check_timeout

Maximum execution time, in seconds per server, for a barman check command. Set to 0 to disable the timeout. Positive integer, default 30. Global/Server.

compression

Standard compression algorithm applied to WAL files. Possible values are: gzip (requires gzip to be installed on the system), bzip2 (requires bzip2), pigz (requires pigz), pygzip (Python's internal gzip compressor) and pybzip2 (Python's internal bzip2 compressor). Global/Server.

conninfo

Connection string used by Barman to connect to the Postgres server. This is a libpq connection string, consult the PostgreSQL manual (https://www.postgresql.org/docs/current/static/libpq-connect.html#LIBPQ-CONNSTRING) for more information. Commonly used keys are: host, hostaddr, port, dbname, user, password. Server.

create_slot

When set to auto and slot_name is defined, Barman automatically attempts to create the replication slot if not present. When set to manual (default), the replication slot needs to be manually created. Global/Server.

custom_compression_filter

Customised compression algorithm applied to WAL files. Global/Server.

custom_decompression_filter

Customised decompression algorithm applied to compressed WAL files; this must match the compression algorithm. Global/Server.

description

A human readable description of a server. Server.

errors_directory

Directory that contains WAL files that contain an error; usually this is related to a conflict with an existing WAL file (e.g. a WAL file that has been archived after a streamed one).

immediate_checkpoint

This option allows you to control the way PostgreSQL handles checkpoint at the start of the backup. If set to false (default), the I/O workload for the checkpoint will be limited, according to the checkpoint_completion_target setting on the PostgreSQL server. If set to true, an immediate checkpoint will be requested, meaning that PostgreSQL will complete the checkpoint as soon as possible. Global/Server.

incoming_wals_directory

Directory where incoming WAL files are archived into. Requires archiver to be enabled. Server.

last_backup_maximum_age

This option identifies a time frame that must contain the latest backup. If the latest backup is older than the time frame, barman check command will report an error to the user. If empty (default), latest backup is always considered valid. Syntax for this option is: "i (DAYS | WEEKS | MONTHS)" where i is a integer greater than zero, representing the number of days | weeks | months of the time frame. Global/Server.

log_file

Location of Barman's log file. Global.

log_level

Level of logging (DEBUG, INFO, WARNING, ERROR, CRITICAL). Global.

max_incoming_wals_queue

Maximum number of WAL files in the incoming queue (in both streaming and archiving pools) that are allowed before barman check returns an error (that does not block backups). Global/Server. Default: None (disabled).

minimum_redundancy

Minimum number of backups to be retained. Default 0. Global/Server.

network_compression

This option allows you to enable data compression for network transfers. If set to false (default), no compression is used. If set to true, compression is enabled, reducing network usage. Global/Server.

parallel_jobs

This option controls how many parallel workers will copy files during a backup or recovery command. Default 1. Global/Server. For backup purposes, it works only when backup_method is rsync.

path_prefix

One or more absolute paths, separated by colon, where Barman looks for executable files. The paths specified in path_prefix are tried before the ones specified in PATH environment variable. Global/server.

post_archive_retry_script

Hook script launched after a WAL file is archived by maintenance. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. In a post archive scenario, ABORT_STOP has currently the same effects as ABORT_CONTINUE. Global/Server.

post_archive_script

Hook script launched after a WAL file is archived by maintenance, after 'post_archive_retry_script'. Global/Server.

post_backup_retry_script

Hook script launched after a base backup. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. In a post backup scenario, ABORT_STOP has currently the same effects as ABORT_CONTINUE. Global/Server.

post_backup_script

Hook script launched after a base backup, after 'post_backup_retry_script'. Global/Server.

post_delete_retry_script

Hook script launched after the deletion of a backup. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. In a post delete scenario, ABORT_STOP has currently the same effects as ABORT_CONTINUE. Global/Server.

post_delete_script

Hook script launched after the deletion of a backup, after 'post_delete_retry_script'. Global/Server.

post_recovery_retry_script

Hook script launched after a recovery. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. In a post recovery scenario, ABORT_STOP has currently the same effects as ABORT_CONTINUE. Global/Server.

post_recovery_script

Hook script launched after a recovery, after 'post_recovery_retry_script'. Global/Server.

post_wal_delete_retry_script

Hook script launched after the deletion of a WAL file. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. In a post delete scenario, ABORT_STOP has currently the same effects as ABORT_CONTINUE. Global/Server.

post_wal_delete_script

Hook script launched after the deletion of a WAL file, after 'post_wal)delete_retry_script'. Global/Server.

pre_archive_retry_script

Hook script launched before a WAL file is archived by maintenance, after 'pre_archive_script'. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. Returning ABORT_STOP will propagate the failure at a higher level and interrupt the WAL archiving operation. Global/Server.

pre_archive_script

Hook script launched before a WAL file is archived by maintenance. Global/Server.

pre_backup_retry_script

Hook script launched before a base backup, after 'pre_backup_script'. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. Returning ABORT_STOP will propagate the failure at a higher level and interrupt the backup operation. Global/Server.

pre_backup_script

Hook script launched before a base backup. Global/Server.

pre_delete_retry_script

Hook script launched before the deletion of a backup, after 'pre_delete_script'. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. Returning ABORT_STOP will propagate the failure at a higher level and interrupt the backup deletion. Global/Server.

pre_delete_script

Hook script launched before the deletion of a backup. Global/Server.

pre_recovery_retry_script

Hook script launched before a recovery, after 'pre_recovery_script'. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. Returning ABORT_STOP will propagate the failure at a higher level and interrupt the recover operation. Global/Server.

pre_recovery_script

Hook script launched before a recovery. Global/Server.

pre_wal_delete_retry_script

Hook script launched before the deletion of a WAL file, after 'pre_wal_delete_script'. Being this a retry hook script, Barman will retry the execution of the script until this either returns a SUCCESS (0), an ABORT_CONTINUE (62) or an ABORT_STOP (63) code. Returning ABORT_STOP will propagate the failure at a higher level and interrupt the WAL file deletion. Global/Server.

pre_wal_delete_script

Hook script launched before the deletion of a WAL file. Global/Server.

primary_ssh_command

Parameter that identifies a Barman server as passive. In a passive node, the source of a backup server is a Barman installation rather than a PostgreSQL server. If primary_ssh_command is specified, Barman uses it to establish a connection with the primary server. Empty by default, it can also be set globally.

recovery_options

Options for recovery operations. Currently only supports get-wal. get-wal activates generation of a basic restore_command in the resulting recovery configuration that uses the barman get-wal command to fetch WAL files directly from Barman's archive of WALs. Comma separated list of values, default empty. Global/Server.

retention_policy

Policy for retention of periodic backups and archive logs. If left empty, retention policies are not enforced. For redundancy based retention policy use "REDUNDANCY i" (where i is an integer > 0 and defines the number of backups to retain). For recovery window retention policy use "RECOVERY WINDOW OF i DAYS" or "RECOVERY WINDOW OF i WEEKS" or "RECOVERY WINDOW OF i MONTHS" where i is a positive integer representing, specifically, the number of days, weeks or months to retain your backups. For more detailed information, refer to the official documentation. Default value is empty. Global/Server.

retention_policy_mode

Currently only "auto" is implemented. Global/Server.

reuse_backup

This option controls incremental backup support. Global/Server. Possible values are:

•

off: disabled (default);

•

copy: reuse the last available backup for a server and create a copy of the unchanged files (reduce backup time);

•

link: reuse the last available backup for a server and create a hard link of the unchanged files (reduce backup time and space). Requires operating system and file system support for hard links.

slot_name

Physical replication slot to be used by the receive-wal command when streaming_archiver is set to on. Requires PostgreSQL >= 9.4. Global/Server. Default: None (disabled).

ssh_command

Command used by Barman to login to the Postgres server via ssh. Server.

streaming_archiver

This option allows you to use the PostgreSQL's streaming protocol to receive transaction logs from a server. If set to on, Barman expects to find pg_receivewal (known as pg_receivexlog prior to PostgreSQL 10) in the PATH (see path_prefix option) and that streaming connection for the server is working. This activates connection checks as well as management (including compression) of WAL files. If set to off (default) barman will rely only on continuous archiving for a server WAL archive operations, eventually terminating any running pg_receivexlog for the server. Global/Server.

streaming_archiver_batch_size

This option allows you to activate batch processing of WAL files for the streaming_archiver process, by setting it to a value > 0. Otherwise, the traditional unlimited processing of the WAL queue is enabled. When batch processing is activated, the archive-wal process would limit itself to maximum streaming_archiver_batch_size WAL segments per single run. Integer. Global/Server.

streaming_archiver_name

Identifier to be used as application_name by the receive-wal command. Only available with pg_receivewal (or pg_receivexlog >= 9.3). By default it is set to barman_receive_wal. Global/Server.

streaming_backup_name

Identifier to be used as application_name by the pg_basebackup command. Only available with pg_basebackup >= 9.3. By default it is set to barman_streaming_backup. Global/Server.

streaming_conninfo

Connection string used by Barman to connect to the Postgres server via streaming replication protocol. By default it is set to conninfo. Server.

streaming_wals_directory

Directory where WAL files are streamed from the PostgreSQL server to Barman. Requires streaming_archiver to be enabled. Server.

tablespace_bandwidth_limit

This option allows you to specify a maximum transfer rate in kilobytes per second, by specifying a comma separated list of tablespaces (pairs TBNAME:BWLIMIT). A value of zero specifies no limit (default). Global/Server.

wal_retention_policy

Policy for retention of archive logs (WAL files). Currently only "MAIN" is available. Global/Server.

wals_directory

Directory which contains WAL files. Server.

## HOOK SCRIPTS
The script definition is passed to a shell and can return any exit code.

The shell environment will contain the following variables:

BARMAN_CONFIGURATION

configuration file used by barman

BARMAN_ERROR

error message, if any (only for the 'post' phase)

BARMAN_PHASE

'pre' or 'post'

BARMAN_RETRY

1 if it is a retry script (from 1.5.0), 0 if not

BARMAN_SERVER

name of the server

Backup scripts specific variables:

BARMAN_BACKUP_DIR

backup destination directory

BARMAN_BACKUP_ID

ID of the backup

BARMAN_PREVIOUS_ID

ID of the previous backup (if present)

BARMAN_NEXT_ID

ID of the next backup (if present)

BARMAN_STATUS

status of the backup

BARMAN_VERSION

version of Barman

Archive scripts specific variables:

BARMAN_SEGMENT

name of the WAL file

BARMAN_FILE

full path of the WAL file

BARMAN_SIZE

size of the WAL file

BARMAN_TIMESTAMP

WAL file timestamp

BARMAN_COMPRESSION

type of compression used for the WAL file

Recovery scripts specific variables:

BARMAN_DESTINATION_DIRECTORY

the directory where the new instance is recovered

BARMAN_TABLESPACES

tablespace relocation map (JSON, if present)

BARMAN_REMOTE_COMMAND

secure shell command used by the recovery (if present)

BARMAN_RECOVER_OPTIONS

recovery additional options (JSON, if present)

Only in case of retry hook scripts, the exit code of the script is checked by Barman. Output of hook scripts is simply written in the log file.

## EXAMPLE
Here is an example of configuration file:

```
[barman]
; Main directory
barman_home = /var/lib/barman
; System user
barman_user = barman
; Log location
log_file = /var/log/barman/barman.log
; Default compression level
;compression = gzip
; Incremental backup
reuse_backup = link
; 'main' PostgreSQL Server configuration
[main]
; Human readable description
description =  "Main PostgreSQL Database"
; SSH options
ssh_command = ssh postgres@pg
; PostgreSQL connection string
conninfo = host=pg user=postgres
; PostgreSQL streaming connection string
streaming_conninfo = host=pg user=postgres
; Minimum number of required backups (redundancy)
minimum_redundancy = 1
; Retention policy (based on redundancy)
retention_policy = REDUNDANCY 2

```

## SEE ALSO
barman (1).

## AUTHORS
In alphabetical order:

•

Gabriele Bartolini <gabriele.bartolini@2ndquadrant.it> (architect)

•

Jonathan Battiato <jonathan.battiato@2ndquadrant.it> (QA/testing)

•

Giulio Calacoci <giulio.calacoci@2ndquadrant.it> (developer)

•

Francesco Canovai <francesco.canovai@2ndquadrant.it> (QA/testing)

•

Leonardo Cecchi <leonardo.cecchi@2ndquadrant.it> (developer)

•

Gianni Ciolli <gianni.ciolli@2ndquadrant.it> (QA/testing)

•

Britt Cole <britt.cole@2ndquadrant.com> (documentation)

•

Marco Nenciarini <marco.nenciarini@2ndquadrant.it> (project leader)

•

Rubens Souza <rubens.souza@2ndquadrant.it> (QA/testing)

Past contributors:

•

Carlo Ascani

•

Stefano Bianucci

•

Giuseppe Broccolo

## RESOURCES
•

Homepage: <http://www.pgbarman.org/>

•

Documentation: <http://docs.pgbarman.org/>

•

Professional support: <https://www.2ndQuadrant.com/>

## COPYING
Barman is the property of 2ndQuadrant Limited and its code is distributed under GNU General Public License v3.

Copyright (C) 2011-2020 2ndQuadrant Limited - https://www.2ndQuadrant.com/.

## AUTHORS
2ndQuadrant Limited <https://www.2ndQuadrant.com>.


named.conf

package: bind

title: named.conf(5)

summary: configuration file for **named**

text:
# named.conf(5)

## NAME
named.conf - configuration file for **named**

## SYNOPSIS
named.conf

## DESCRIPTION
named.conf is the configuration file for named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line

### ACL

```
acl string { address_match_element; ... };
```

### CONTROLS

```
controls {

      inet ( ipv4_address | ipv6_address |

          * ) [ port ( integer | * ) ] allow

          { address_match_element; ... } [

          keys { string; ... } ] [ read-only

          boolean ];

      unix quoted_string perm integer

          owner integer group integer [

          keys { string; ... } ] [ read-only

          boolean ];
};
```

### DLZ

```
dlz string {

      database string;

      search boolean;
};
```

### DNSSEC-POLICY

```
dnssec-policy string {

      dnskey-ttl duration;

      keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime

          duration_or_unlimited algorithm string [ integer ]; ... };

      max-zone-ttl duration;

      nsec3param [ iterations integer ] [ optout boolean ] [

          salt-length integer ];

      parent-ds-ttl duration;

      parent-propagation-delay duration;

      publish-safety duration;

      purge-keys duration;

      retire-safety duration;

      signatures-refresh duration;

      signatures-validity duration;

      signatures-validity-dnskey duration;

      zone-propagation-delay duration;
};
```

### DYNDB

```
dyndb string quoted_string {

    unspecified-text };
```

### KEY

```
key string {

      algorithm string;

      secret string;
};
```

### LOGGING

```
logging {

      category string { string; ... };

      channel string {

              buffered boolean;

              file quoted_string [ versions ( unlimited | integer ) ]

                  [ size size ] [ suffix ( increment | timestamp ) ];

              null;

              print-category boolean;

              print-severity boolean;

              print-time ( iso8601 | iso8601-utc | local | boolean );

              severity log_severity;

              stderr;

              syslog [ syslog_facility ];

      };
};
```

### MANAGED-KEYS
See DNSSEC-KEYS.

```
managed-keys { string ( static-key

    | initial-key | static-ds |

    initial-ds ) integer integer

    integer quoted_string; ... };, deprecated
```

### MASTERS

```
masters string [ port integer ] [ dscp

    integer ] { ( remote-servers |

    ipv4_address [ port integer ] |

    ipv6_address [ port integer ] ) [ key

    string ]; ... };
```

### OPTIONS

```
options {

      allow-new-zones boolean;

      allow-notify { address_match_element; ... };

      allow-query { address_match_element; ... };

      allow-query-cache { address_match_element; ... };

      allow-query-cache-on { address_match_element; ... };

      allow-query-on { address_match_element; ... };

      allow-recursion { address_match_element; ... };

      allow-recursion-on { address_match_element; ... };

      allow-transfer { address_match_element; ... };

      allow-update { address_match_element; ... };

      allow-update-forwarding { address_match_element; ... };

      also-notify [ port integer ] [ dscp integer ] { (

          remote-servers | ipv4_address [ port integer ] |

          ipv6_address [ port integer ] ) [ key string ]; ... };

      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |

          * ) ] [ dscp integer ];

      answer-cookie boolean;

      attach-cache string;

      auth-nxdomain boolean; // default changed

      auto-dnssec ( allow | maintain | off );// deprecated

      automatic-interface-scan boolean;

      avoid-v4-udp-ports { portrange; ... };

      avoid-v6-udp-ports { portrange; ... };

      bindkeys-file quoted_string;

      blackhole { address_match_element; ... };

      cache-file quoted_string;// deprecated

      catalog-zones { zone string [ default-masters [ port integer ]

          [ dscp integer ] { ( remote-servers | ipv4_address [ port

          integer ] | ipv6_address [ port integer ] ) [ key

          string ]; ... } ] [ zone-directory quoted_string ] [

          in-memory boolean ] [ min-update-interval duration ]; ... };

      check-dup-records ( fail | warn | ignore );

      check-integrity boolean;

      check-mx ( fail | warn | ignore );

      check-mx-cname ( fail | warn | ignore );

      check-names ( primary | master |

          secondary | slave | response ) (

          fail | warn | ignore );

      check-sibling boolean;

      check-spf ( warn | ignore );

      check-srv-cname ( fail | warn | ignore );

      check-wildcard boolean;

      clients-per-query integer;

      cookie-algorithm ( aes | siphash24 );

      cookie-secret string;

      coresize ( default | unlimited | sizeval );

      datasize ( default | unlimited | sizeval );

      deny-answer-addresses { address_match_element; ... } [

          except-from { string; ... } ];

      deny-answer-aliases { string; ... } [ except-from { string; ...

          } ];

      dialup ( notify | notify-passive | passive | refresh | boolean );

      directory quoted_string;

      disable-algorithms string { string;

          ... };

      disable-ds-digests string { string;

          ... };

      disable-empty-zone string;

      dns64 netprefix {

              break-dnssec boolean;

              clients { address_match_element; ... };

              exclude { address_match_element; ... };

              mapped { address_match_element; ... };

              recursive-only boolean;

              suffix ipv6_address;

      };

      dns64-contact string;

      dns64-server string;

      dnskey-sig-validity integer;

      dnsrps-enable boolean;

      dnsrps-options { unspecified-text };

      dnssec-accept-expired boolean;

      dnssec-dnskey-kskonly boolean;

      dnssec-loadkeys-interval integer;

      dnssec-must-be-secure string boolean;

      dnssec-policy string;

      dnssec-secure-to-insecure boolean;

      dnssec-update-mode ( maintain | no-resign );

      dnssec-validation ( yes | no | auto );

      dnstap { ( all | auth | client | forwarder | resolver | update ) [

          ( query | response ) ]; ... };

      dnstap-identity ( quoted_string | none | hostname );

      dnstap-output ( file | unix ) quoted_string [ size ( unlimited |

          size ) ] [ versions ( unlimited | integer ) ] [ suffix (

          increment | timestamp ) ];

      dnstap-version ( quoted_string | none );

      dscp integer;

      dual-stack-servers [ port integer ] { ( quoted_string [ port

          integer ] [ dscp integer ] | ipv4_address [ port

          integer ] [ dscp integer ] | ipv6_address [ port

          integer ] [ dscp integer ] ); ... };

      dump-file quoted_string;

      edns-udp-size integer;

      empty-contact string;

      empty-server string;

      empty-zones-enable boolean;

      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;

      fetches-per-server integer [ ( drop | fail ) ];

      fetches-per-zone integer [ ( drop | fail ) ];

      files ( default | unlimited | sizeval );

      flush-zones-on-shutdown boolean;

      forward ( first | only );

      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address

          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };

      fstrm-set-buffer-hint integer;

      fstrm-set-flush-timeout integer;

      fstrm-set-input-queue-size integer;

      fstrm-set-output-notify-threshold integer;

      fstrm-set-output-queue-model ( mpsc | spsc );

      fstrm-set-output-queue-size integer;

      fstrm-set-reopen-interval duration;

      geoip-directory ( quoted_string | none );

      glue-cache boolean;

      heartbeat-interval integer;

      hostname ( quoted_string | none );

      interface-interval duration;

      ixfr-from-differences ( primary | master | secondary | slave |

          boolean );

      keep-response-order { address_match_element; ... };

      key-directory quoted_string;

      lame-ttl duration;

      listen-on [ port integer ] [ dscp

          integer ] {

          address_match_element; ... };

      listen-on-v6 [ port integer ] [ dscp

          integer ] {

          address_match_element; ... };

      lmdb-mapsize sizeval;

      lock-file ( quoted_string | none );

      managed-keys-directory quoted_string;

      masterfile-format ( map | raw | text );

      masterfile-style ( full | relative );

      match-mapped-addresses boolean;

      max-cache-size ( default | unlimited | sizeval | percentage );

      max-cache-ttl duration;

      max-clients-per-query integer;

      max-ixfr-ratio ( unlimited | percentage );

      max-journal-size ( default | unlimited | sizeval );

      max-ncache-ttl duration;

      max-records integer;

      max-recursion-depth integer;

      max-recursion-queries integer;

      max-refresh-time integer;

      max-retry-time integer;

      max-rsa-exponent-size integer;

      max-stale-ttl duration;

      max-transfer-idle-in integer;

      max-transfer-idle-out integer;

      max-transfer-time-in integer;

      max-transfer-time-out integer;

      max-udp-size integer;

      max-zone-ttl ( unlimited | duration );

      memstatistics boolean;

      memstatistics-file quoted_string;

      message-compression boolean;

      min-cache-ttl duration;

      min-ncache-ttl duration;

      min-refresh-time integer;

      min-retry-time integer;

      minimal-any boolean;

      minimal-responses ( no-auth | no-auth-recursive | boolean );

      multi-master boolean;

      new-zones-directory quoted_string;

      no-case-compress { address_match_element; ... };

      nocookie-udp-size integer;

      notify ( explicit | master-only | primary-only | boolean );

      notify-delay integer;

      notify-rate integer;

      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]

          [ dscp integer ];

      notify-to-soa boolean;

      nta-lifetime duration;

      nta-recheck duration;

      nxdomain-redirect string;

      parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      pid-file ( quoted_string | none );

      port integer;

      preferred-glue string;

      prefetch integer [ integer ];

      provide-ixfr boolean;

      qname-minimization ( strict | relaxed | disabled | off );

      query-source ( ( [ address ] ( ipv4_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      querylog boolean;

      random-device ( quoted_string | none );

      rate-limit {

              all-per-second integer;

              errors-per-second integer;

              exempt-clients { address_match_element; ... };

              ipv4-prefix-length integer;

              ipv6-prefix-length integer;

              log-only boolean;

              max-table-size integer;

              min-table-size integer;

              nodata-per-second integer;

              nxdomains-per-second integer;

              qps-scale integer;

              referrals-per-second integer;

              responses-per-second integer;

              slip integer;

              window integer;

      };

      recursing-file quoted_string;

      recursion boolean;

      recursive-clients integer;

      request-expire boolean;

      request-ixfr boolean;

      request-nsid boolean;

      require-server-cookie boolean;

      reserved-sockets integer;

      resolver-nonbackoff-tries integer;

      resolver-query-timeout integer;

      resolver-retry-interval integer;

      response-padding { address_match_element; ... } block-size

          integer;

      response-policy { zone string [ add-soa boolean ] [ log

          boolean ] [ max-policy-ttl duration ] [ min-update-interval

          duration ] [ policy ( cname | disabled | drop | given | no-op

          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [

          recursive-only boolean ] [ nsip-enable boolean ] [

          nsdname-enable boolean ]; ... } [ add-soa boolean ] [

          break-dnssec boolean ] [ max-policy-ttl duration ] [

          min-update-interval duration ] [ min-ns-dots integer ] [

          nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]

          [ recursive-only boolean ] [ nsip-enable boolean ] [

          nsdname-enable boolean ] [ dnsrps-enable boolean ] [

          dnsrps-options { unspecified-text } ];

      reuseport boolean;

      root-delegation-only [ exclude { string; ... } ];

      root-key-sentinel boolean;

      rrset-order { [ class string ] [ type string ] [ name

          quoted_string ] string string; ... };

      secroots-file quoted_string;

      send-cookie boolean;

      serial-query-rate integer;

      serial-update-method ( date | increment | unixtime );

      server-id ( quoted_string | none | hostname );

      servfail-ttl duration;

      session-keyalg string;

      session-keyfile ( quoted_string | none );

      session-keyname string;

      sig-signing-nodes integer;

      sig-signing-signatures integer;

      sig-signing-type integer;

      sig-validity-interval integer [ integer ];

      sortlist { address_match_element; ... };

      stacksize ( default | unlimited | sizeval );

      stale-answer-client-timeout ( disabled | off | integer );

      stale-answer-enable boolean;

      stale-answer-ttl duration;

      stale-cache-enable boolean;

      stale-refresh-time duration;

      startup-notify-rate integer;

      statistics-file quoted_string;

      synth-from-dnssec boolean;

      tcp-advertised-timeout integer;

      tcp-clients integer;

      tcp-idle-timeout integer;

      tcp-initial-timeout integer;

      tcp-keepalive-timeout integer;

      tcp-listen-queue integer;

      tkey-dhkey quoted_string integer;

      tkey-domain quoted_string;

      tkey-gssapi-credential quoted_string;

      tkey-gssapi-keytab quoted_string;

      transfer-format ( many-answers | one-answer );

      transfer-message-size integer;

      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      transfers-in integer;

      transfers-out integer;

      transfers-per-ns integer;

      trust-anchor-telemetry boolean; // experimental

      try-tcp-refresh boolean;

      update-check-ksk boolean;

      update-quota integer;

      use-alt-transfer-source boolean;

      use-v4-udp-ports { portrange; ... };

      use-v6-udp-ports { portrange; ... };

      v6-bias integer;

      validate-except { string; ... };

      version ( quoted_string | none );

      zero-no-soa-ttl boolean;

      zero-no-soa-ttl-cache boolean;

      zone-statistics ( full | terse | none | boolean );
};
```

### PARENTAL-AGENTS

```
parental-agents string [ port integer ] [

    dscp integer ] { ( remote-servers |

    ipv4_address [ port integer ] |

    ipv6_address [ port integer ] ) [ key

    string ]; ... };
```

### PLUGIN

```
plugin ( query ) string [ { unspecified-text

    } ];
```

### PRIMARIES

```
primaries string [ port integer ] [ dscp

    integer ] { ( remote-servers |

    ipv4_address [ port integer ] |

    ipv6_address [ port integer ] ) [ key

    string ]; ... };
```

### SERVER

```
server netprefix {

      bogus boolean;

      edns boolean;

      edns-udp-size integer;

      edns-version integer;

      keys server_key;

      max-udp-size integer;

      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]

          [ dscp integer ];

      padding integer;

      provide-ixfr boolean;

      query-source ( ( [ address ] ( ipv4_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      request-expire boolean;

      request-ixfr boolean;

      request-nsid boolean;

      send-cookie boolean;

      tcp-keepalive boolean;

      tcp-only boolean;

      transfer-format ( many-answers | one-answer );

      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      transfers integer;
};
```

### STATISTICS-CHANNELS

```
statistics-channels {

      inet ( ipv4_address | ipv6_address |

          * ) [ port ( integer | * ) ] [

          allow { address_match_element; ...

          } ];
};
```

### TRUST-ANCHORS

```
trust-anchors { string ( static-key |

    initial-key | static-ds | initial-ds )

    integer integer integer

    quoted_string; ... };
```

### TRUSTED-KEYS
Deprecated - see DNSSEC-KEYS.

```
trusted-keys { string integer

    integer integer

    quoted_string; ... };, deprecated
```

### VIEW

```
view string [ class ] {

      allow-new-zones boolean;

      allow-notify { address_match_element; ... };

      allow-query { address_match_element; ... };

      allow-query-cache { address_match_element; ... };

      allow-query-cache-on { address_match_element; ... };

      allow-query-on { address_match_element; ... };

      allow-recursion { address_match_element; ... };

      allow-recursion-on { address_match_element; ... };

      allow-transfer { address_match_element; ... };

      allow-update { address_match_element; ... };

      allow-update-forwarding { address_match_element; ... };

      also-notify [ port integer ] [ dscp integer ] { (

          remote-servers | ipv4_address [ port integer ] |

          ipv6_address [ port integer ] ) [ key string ]; ... };

      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |

          * ) ] [ dscp integer ];

      attach-cache string;

      auth-nxdomain boolean; // default changed

      auto-dnssec ( allow | maintain | off );// deprecated

      cache-file quoted_string;// deprecated

      catalog-zones { zone string [ default-masters [ port integer ]

          [ dscp integer ] { ( remote-servers | ipv4_address [ port

          integer ] | ipv6_address [ port integer ] ) [ key

          string ]; ... } ] [ zone-directory quoted_string ] [

          in-memory boolean ] [ min-update-interval duration ]; ... };

      check-dup-records ( fail | warn | ignore );

      check-integrity boolean;

      check-mx ( fail | warn | ignore );

      check-mx-cname ( fail | warn | ignore );

      check-names ( primary | master |

          secondary | slave | response ) (

          fail | warn | ignore );

      check-sibling boolean;

      check-spf ( warn | ignore );

      check-srv-cname ( fail | warn | ignore );

      check-wildcard boolean;

      clients-per-query integer;

      deny-answer-addresses { address_match_element; ... } [

          except-from { string; ... } ];

      deny-answer-aliases { string; ... } [ except-from { string; ...

          } ];

      dialup ( notify | notify-passive | passive | refresh | boolean );

      disable-algorithms string { string;

          ... };

      disable-ds-digests string { string;

          ... };

      disable-empty-zone string;

      dlz string {

              database string;

              search boolean;

      };

      dns64 netprefix {

              break-dnssec boolean;

              clients { address_match_element; ... };

              exclude { address_match_element; ... };

              mapped { address_match_element; ... };

              recursive-only boolean;

              suffix ipv6_address;

      };

      dns64-contact string;

      dns64-server string;

      dnskey-sig-validity integer;

      dnsrps-enable boolean;

      dnsrps-options { unspecified-text };

      dnssec-accept-expired boolean;

      dnssec-dnskey-kskonly boolean;

      dnssec-loadkeys-interval integer;

      dnssec-must-be-secure string boolean;

      dnssec-policy string;

      dnssec-secure-to-insecure boolean;

      dnssec-update-mode ( maintain | no-resign );

      dnssec-validation ( yes | no | auto );

      dnstap { ( all | auth | client | forwarder | resolver | update ) [

          ( query | response ) ]; ... };

      dual-stack-servers [ port integer ] { ( quoted_string [ port

          integer ] [ dscp integer ] | ipv4_address [ port

          integer ] [ dscp integer ] | ipv6_address [ port

          integer ] [ dscp integer ] ); ... };

      dyndb string quoted_string {

          unspecified-text };

      edns-udp-size integer;

      empty-contact string;

      empty-server string;

      empty-zones-enable boolean;

      fetch-quota-params integer fixedpoint fixedpoint fixedpoint;

      fetches-per-server integer [ ( drop | fail ) ];

      fetches-per-zone integer [ ( drop | fail ) ];

      forward ( first | only );

      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address

          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };

      glue-cache boolean;

      ixfr-from-differences ( primary | master | secondary | slave |

          boolean );

      key string {

              algorithm string;

              secret string;

      };

      key-directory quoted_string;

      lame-ttl duration;

      lmdb-mapsize sizeval;

      managed-keys { string (

          static-key | initial-key

          | static-ds | initial-ds

          ) integer integer

          integer

          quoted_string; ... };, deprecated

      masterfile-format ( map | raw | text );

      masterfile-style ( full | relative );

      match-clients { address_match_element; ... };

      match-destinations { address_match_element; ... };

      match-recursive-only boolean;

      max-cache-size ( default | unlimited | sizeval | percentage );

      max-cache-ttl duration;

      max-clients-per-query integer;

      max-ixfr-ratio ( unlimited | percentage );

      max-journal-size ( default | unlimited | sizeval );

      max-ncache-ttl duration;

      max-records integer;

      max-recursion-depth integer;

      max-recursion-queries integer;

      max-refresh-time integer;

      max-retry-time integer;

      max-stale-ttl duration;

      max-transfer-idle-in integer;

      max-transfer-idle-out integer;

      max-transfer-time-in integer;

      max-transfer-time-out integer;

      max-udp-size integer;

      max-zone-ttl ( unlimited | duration );

      message-compression boolean;

      min-cache-ttl duration;

      min-ncache-ttl duration;

      min-refresh-time integer;

      min-retry-time integer;

      minimal-any boolean;

      minimal-responses ( no-auth | no-auth-recursive | boolean );

      multi-master boolean;

      new-zones-directory quoted_string;

      no-case-compress { address_match_element; ... };

      nocookie-udp-size integer;

      notify ( explicit | master-only | primary-only | boolean );

      notify-delay integer;

      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]

          [ dscp integer ];

      notify-to-soa boolean;

      nta-lifetime duration;

      nta-recheck duration;

      nxdomain-redirect string;

      parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      plugin ( query ) string [ {

          unspecified-text } ];

      preferred-glue string;

      prefetch integer [ integer ];

      provide-ixfr boolean;

      qname-minimization ( strict | relaxed | disabled | off );

      query-source ( ( [ address ] ( ipv4_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (

          integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]

          port ( integer | * ) ) ) [ dscp integer ];

      rate-limit {

              all-per-second integer;

              errors-per-second integer;

              exempt-clients { address_match_element; ... };

              ipv4-prefix-length integer;

              ipv6-prefix-length integer;

              log-only boolean;

              max-table-size integer;

              min-table-size integer;

              nodata-per-second integer;

              nxdomains-per-second integer;

              qps-scale integer;

              referrals-per-second integer;

              responses-per-second integer;

              slip integer;

              window integer;

      };

      recursion boolean;

      request-expire boolean;

      request-ixfr boolean;

      request-nsid boolean;

      require-server-cookie boolean;

      resolver-nonbackoff-tries integer;

      resolver-query-timeout integer;

      resolver-retry-interval integer;

      response-padding { address_match_element; ... } block-size

          integer;

      response-policy { zone string [ add-soa boolean ] [ log

          boolean ] [ max-policy-ttl duration ] [ min-update-interval

          duration ] [ policy ( cname | disabled | drop | given | no-op

          | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [

          recursive-only boolean ] [ nsip-enable boolean ] [

          nsdname-enable boolean ]; ... } [ add-soa boolean ] [

          break-dnssec boolean ] [ max-policy-ttl duration ] [

          min-update-interval duration ] [ min-ns-dots integer ] [

          nsip-wait-recurse boolean ] [ qname-wait-recurse boolean ]

          [ recursive-only boolean ] [ nsip-enable boolean ] [

          nsdname-enable boolean ] [ dnsrps-enable boolean ] [

          dnsrps-options { unspecified-text } ];

      root-delegation-only [ exclude { string; ... } ];

      root-key-sentinel boolean;

      rrset-order { [ class string ] [ type string ] [ name

          quoted_string ] string string; ... };

      send-cookie boolean;

      serial-update-method ( date | increment | unixtime );

      server netprefix {

              bogus boolean;

              edns boolean;

              edns-udp-size integer;

              edns-version integer;

              keys server_key;

              max-udp-size integer;

              notify-source ( ipv4_address | * ) [ port ( integer | *

                  ) ] [ dscp integer ];

              notify-source-v6 ( ipv6_address | * ) [ port ( integer

                  | * ) ] [ dscp integer ];

              padding integer;

              provide-ixfr boolean;

              query-source ( ( [ address ] ( ipv4_address | * ) [ port

                  ( integer | * ) ] ) | ( [ [ address ] (

                  ipv4_address | * ) ] port ( integer | * ) ) ) [

                  dscp integer ];

              query-source-v6 ( ( [ address ] ( ipv6_address | * ) [

                  port ( integer | * ) ] ) | ( [ [ address ] (

                  ipv6_address | * ) ] port ( integer | * ) ) ) [

                  dscp integer ];

              request-expire boolean;

              request-ixfr boolean;

              request-nsid boolean;

              send-cookie boolean;

              tcp-keepalive boolean;

              tcp-only boolean;

              transfer-format ( many-answers | one-answer );

              transfer-source ( ipv4_address | * ) [ port ( integer |

                  * ) ] [ dscp integer ];

              transfer-source-v6 ( ipv6_address | * ) [ port (

                  integer | * ) ] [ dscp integer ];

              transfers integer;

      };

      servfail-ttl duration;

      sig-signing-nodes integer;

      sig-signing-signatures integer;

      sig-signing-type integer;

      sig-validity-interval integer [ integer ];

      sortlist { address_match_element; ... };

      stale-answer-client-timeout ( disabled | off | integer );

      stale-answer-enable boolean;

      stale-answer-ttl duration;

      stale-cache-enable boolean;

      stale-refresh-time duration;

      synth-from-dnssec boolean;

      transfer-format ( many-answers | one-answer );

      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      trust-anchor-telemetry boolean; // experimental

      trust-anchors { string ( static-key |

          initial-key | static-ds | initial-ds

          ) integer integer integer

          quoted_string; ... };

      trusted-keys { string

          integer integer

          integer

          quoted_string; ... };, deprecated

      try-tcp-refresh boolean;

      update-check-ksk boolean;

      use-alt-transfer-source boolean;

      v6-bias integer;

      validate-except { string; ... };

      zero-no-soa-ttl boolean;

      zero-no-soa-ttl-cache boolean;

      zone string [ class ] {

              allow-notify { address_match_element; ... };

              allow-query { address_match_element; ... };

              allow-query-on { address_match_element; ... };

              allow-transfer { address_match_element; ... };

              allow-update { address_match_element; ... };

              allow-update-forwarding { address_match_element; ... };

              also-notify [ port integer ] [ dscp integer ] { (

                  remote-servers | ipv4_address [ port integer ] |

                  ipv6_address [ port integer ] ) [ key string ];

                  ... };

              alt-transfer-source ( ipv4_address | * ) [ port (

                  integer | * ) ] [ dscp integer ];

              alt-transfer-source-v6 ( ipv6_address | * ) [ port (

                  integer | * ) ] [ dscp integer ];

              auto-dnssec ( allow | maintain | off );// deprecated

              check-dup-records ( fail | warn | ignore );

              check-integrity boolean;

              check-mx ( fail | warn | ignore );

              check-mx-cname ( fail | warn | ignore );

              check-names ( fail | warn | ignore );

              check-sibling boolean;

              check-spf ( warn | ignore );

              check-srv-cname ( fail | warn | ignore );

              check-wildcard boolean;

              database string;

              delegation-only boolean;

              dialup ( notify | notify-passive | passive | refresh |

                  boolean );

              dlz string;

              dnskey-sig-validity integer;

              dnssec-dnskey-kskonly boolean;

              dnssec-loadkeys-interval integer;

              dnssec-policy string;

              dnssec-secure-to-insecure boolean;

              dnssec-update-mode ( maintain | no-resign );

              file quoted_string;

              forward ( first | only );

              forwarders [ port integer ] [ dscp integer ] { (

                  ipv4_address | ipv6_address ) [ port integer ] [

                  dscp integer ]; ... };

              in-view string;

              inline-signing boolean;

              ixfr-from-differences boolean;

              journal quoted_string;

              key-directory quoted_string;

              masterfile-format ( map | raw | text );

              masterfile-style ( full | relative );

              masters [ port integer ] [ dscp integer ] { (

                  remote-servers | ipv4_address [ port integer ] |

                  ipv6_address [ port integer ] ) [ key string ];

                  ... };

              max-ixfr-ratio ( unlimited | percentage );

              max-journal-size ( default | unlimited | sizeval );

              max-records integer;

              max-refresh-time integer;

              max-retry-time integer;

              max-transfer-idle-in integer;

              max-transfer-idle-out integer;

              max-transfer-time-in integer;

              max-transfer-time-out integer;

              max-zone-ttl ( unlimited | duration );

              min-refresh-time integer;

              min-retry-time integer;

              multi-master boolean;

              notify ( explicit | master-only | primary-only | boolean );

              notify-delay integer;

              notify-source ( ipv4_address | * ) [ port ( integer | *

                  ) ] [ dscp integer ];

              notify-source-v6 ( ipv6_address | * ) [ port ( integer

                  | * ) ] [ dscp integer ];

              notify-to-soa boolean;

              parental-agents [ port integer ] [ dscp integer ] { (

                  remote-servers | ipv4_address [ port integer ] |

                  ipv6_address [ port integer ] ) [ key string ];

                  ... };

              parental-source ( ipv4_address | * ) [ port ( integer |

                  * ) ] [ dscp integer ];

              parental-source-v6 ( ipv6_address | * ) [ port (

                  integer | * ) ] [ dscp integer ];

              primaries [ port integer ] [ dscp integer ] { (

                  remote-servers | ipv4_address [ port integer ] |

                  ipv6_address [ port integer ] ) [ key string ];

                  ... };

              request-expire boolean;

              request-ixfr boolean;

              serial-update-method ( date | increment | unixtime );

              server-addresses { ( ipv4_address | ipv6_address ); ... };

              server-names { string; ... };

              sig-signing-nodes integer;

              sig-signing-signatures integer;

              sig-signing-type integer;

              sig-validity-interval integer [ integer ];

              transfer-source ( ipv4_address | * ) [ port ( integer |

                  * ) ] [ dscp integer ];

              transfer-source-v6 ( ipv6_address | * ) [ port (

                  integer | * ) ] [ dscp integer ];

              try-tcp-refresh boolean;

              type ( primary | master | secondary | slave | mirror |

                  delegation-only | forward | hint | redirect |

                  static-stub | stub );

              update-check-ksk boolean;

              update-policy ( local | { ( deny | grant ) string (

                  6to4-self | external | krb5-self | krb5-selfsub |

                  krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |

                  name | self | selfsub | selfwild | subdomain | tcp-self

                  | wildcard | zonesub ) [ string ] rrtypelist; ... } );

              use-alt-transfer-source boolean;

              zero-no-soa-ttl boolean;

              zone-statistics ( full | terse | none | boolean );

      };

      zone-statistics ( full | terse | none | boolean );
};
```

### ZONE

```
zone string [ class ] {

      allow-notify { address_match_element; ... };

      allow-query { address_match_element; ... };

      allow-query-on { address_match_element; ... };

      allow-transfer { address_match_element; ... };

      allow-update { address_match_element; ... };

      allow-update-forwarding { address_match_element; ... };

      also-notify [ port integer ] [ dscp integer ] { (

          remote-servers | ipv4_address [ port integer ] |

          ipv6_address [ port integer ] ) [ key string ]; ... };

      alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |

          * ) ] [ dscp integer ];

      auto-dnssec ( allow | maintain | off );// deprecated

      check-dup-records ( fail | warn | ignore );

      check-integrity boolean;

      check-mx ( fail | warn | ignore );

      check-mx-cname ( fail | warn | ignore );

      check-names ( fail | warn | ignore );

      check-sibling boolean;

      check-spf ( warn | ignore );

      check-srv-cname ( fail | warn | ignore );

      check-wildcard boolean;

      database string;

      delegation-only boolean;

      dialup ( notify | notify-passive | passive | refresh | boolean );

      dlz string;

      dnskey-sig-validity integer;

      dnssec-dnskey-kskonly boolean;

      dnssec-loadkeys-interval integer;

      dnssec-policy string;

      dnssec-secure-to-insecure boolean;

      dnssec-update-mode ( maintain | no-resign );

      file quoted_string;

      forward ( first | only );

      forwarders [ port integer ] [ dscp integer ] { ( ipv4_address

          | ipv6_address ) [ port integer ] [ dscp integer ]; ... };

      in-view string;

      inline-signing boolean;

      ixfr-from-differences boolean;

      journal quoted_string;

      key-directory quoted_string;

      masterfile-format ( map | raw | text );

      masterfile-style ( full | relative );

      masters [ port integer ] [ dscp integer ] { ( remote-servers

          | ipv4_address [ port integer ] | ipv6_address [ port

          integer ] ) [ key string ]; ... };

      max-ixfr-ratio ( unlimited | percentage );

      max-journal-size ( default | unlimited | sizeval );

      max-records integer;

      max-refresh-time integer;

      max-retry-time integer;

      max-transfer-idle-in integer;

      max-transfer-idle-out integer;

      max-transfer-time-in integer;

      max-transfer-time-out integer;

      max-zone-ttl ( unlimited | duration );

      min-refresh-time integer;

      min-retry-time integer;

      multi-master boolean;

      notify ( explicit | master-only | primary-only | boolean );

      notify-delay integer;

      notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]

          [ dscp integer ];

      notify-to-soa boolean;

      parental-agents [ port integer ] [ dscp integer ] { (

          remote-servers | ipv4_address [ port integer ] |

          ipv6_address [ port integer ] ) [ key string ]; ... };

      parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      primaries [ port integer ] [ dscp integer ] { (

          remote-servers | ipv4_address [ port integer ] |

          ipv6_address [ port integer ] ) [ key string ]; ... };

      request-expire boolean;

      request-ixfr boolean;

      serial-update-method ( date | increment | unixtime );

      server-addresses { ( ipv4_address | ipv6_address ); ... };

      server-names { string; ... };

      sig-signing-nodes integer;

      sig-signing-signatures integer;

      sig-signing-type integer;

      sig-validity-interval integer [ integer ];

      transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [

          dscp integer ];

      transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )

          ] [ dscp integer ];

      try-tcp-refresh boolean;

      type ( primary | master | secondary | slave | mirror |

          delegation-only | forward | hint | redirect | static-stub |

          stub );

      update-check-ksk boolean;

      update-policy ( local | { ( deny | grant ) string ( 6to4-self |

          external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self

          | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild

          | subdomain | tcp-self | wildcard | zonesub ) [ string ]

          rrtypelist; ... } );

      use-alt-transfer-source boolean;

      zero-no-soa-ttl boolean;

      zone-statistics ( full | terse | none | boolean );
};
```

## FILES
/etc/named.conf

## SEE ALSO
ddns-confgen(8), named(8), named-checkconf(8), rndc(8), rndc-confgen(8), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


rndc.conf

title: rndc.conf(5)

summary: rndc configuration file

text:
# rndc.conf(5)

## NAME
rndc.conf - rndc configuration file

## SYNOPSIS
rndc.conf

## DESCRIPTION
rndc.conf is the configuration file for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to named.conf. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated. The usual comment styles are supported:

C style: /* */

C++ style: // to end of line

Unix style: # to end of line

rndc.conf is much simpler than named.conf. The file uses three statements: an options statement, a server statement, and a key statement.

The options statement contains five clauses. The default-server clause is followed by the name or address of a name server. This host is used when no name server is given as an argument to rndc. The default-key clause is followed by the name of a key, which is identified by a key statement. If no keyid is provided on the rndc command line, and no key clause is found in a matching server statement, this default key is used to authenticate the server's commands and responses. The default-port clause is followed by the port to connect to on the remote name server. If no port option is provided on the rndc command line, and no port clause is found in a matching server statement, this default port is used to connect. The default-source-address and default-source-address-v6 clauses can be used to set the IPv4 and IPv6 source addresses respectively.

After the server keyword, the server statement includes a string which is the hostname or address for a name server. The statement has three possible clauses: key, port, and addresses. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an addresses clause is supplied, these addresses are used instead of the server name. Each address can take an optional port. If an source-address or source-address-v6 is supplied, it is used to specify the IPv4 and IPv6 source address, respectively.

The key statement begins with an identifying string, the name of the key. The statement has two clauses. algorithm identifies the authentication algorithm for rndc to use; currently only HMAC-MD5 (for compatibility), HMAC-SHA1, HMAC-SHA224, HMAC-SHA256 (default), HMAC-SHA384, and HMAC-SHA512 are supported. This is followed by a secret clause which contains the base-64 encoding of the algorithm's authentication key. The base-64 string is enclosed in double quotes.

There are two common ways to generate the base-64 string for the secret. The BIND 9 program rndc-confgen can be used to generate a random key, or the mmencode program, also known as mimencode, can be used to generate a base-64 string from known input. mmencode does not ship with BIND 9 but is available on many systems. See the Example section for sample command lines for each.

## EXAMPLE

```
options {

  default-server  localhost;

  default-key     samplekey;
};
```

```
server localhost {

  key             samplekey;
};
```

```
server testserver {

  key     testkey;

  addresses   { localhost port 5353; };
};
```

```
key samplekey {

  algorithm       hmac-sha256;

  secret          "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
};
```

```
key testkey {

  algorithm   hmac-sha256;

  secret      "R3HI8P6BKw9ZwXwN3VZKuQ==";
};
```

In the above example, rndc by default uses the server at localhost (127.0.0.1) and the key called "samplekey". Commands to the localhost server use the "samplekey" key, which must also be defined in the server's configuration file with the same name and secret. The key statement indicates that "samplekey" uses the HMAC-SHA256 algorithm and its secret clause contains the base-64 encoding of the HMAC-SHA256 secret enclosed in double quotes.

If rndc -s testserver is used, then rndc connects to the server on localhost port 5353 using the key "testkey".

To generate a random secret with rndc-confgen:

rndc-confgen

A complete rndc.conf file, including the randomly generated key, is written to the standard output. Commented-out key and controls statements for named.conf are also printed.

To generate a base-64 secret with mmencode:

echo "known plaintext for a secret" | mmencode

## NAME SERVER CONFIGURATION
The name server must be configured to accept rndc connections and to recognize the key specified in the rndc.conf file, using the controls statement in named.conf. See the sections on the controls statement in the BIND 9 Administrator Reference Manual for details.

## SEE ALSO
rndc(8), rndc-confgen(8), mmencode(1), BIND 9 Administrator Reference Manual.

## AUTHOR
Internet Systems Consortium

## COPYRIGHT
2024, Internet Systems Consortium


bitlbee.conf

package: bitlbee

title: bitlbee.conf(5)

summary: configuration file for

text:
# bitlbee.conf(5)

## NAME
bitlbee.conf - configuration file for bitlbee(8)

## DESCRIPTION
This file contains system-wide settings for the bitlbee(8) program. For more information about the file syntax, please read the example configuration file which comes with the program. The default file contains lots of comments which explain all the available options.

## SEE ALSO
bitlbee(8)


bld.conf

package: bld

title: bld.conf(5)

text:
# bld.conf(5)

## NAME
bld.conf - Configuration file for BLD

## DESCRIPTION
bld.conf consists of lines used to set various configuration options for bld. The lines are processed in order of appearance. Options set via bld.conf are overriden by bld command line options. If two lines assign different values to the same variables, the last is used. Blank lines and lines beginning with a `#' are ignored.

bld.conf lines have the following format:

variable = value

variable can be on of the following:

- daemon: (0 or 1) fork to background or not.

- address: IP address to bind to.

- port: port to listen to.

- min_interval: minimum time interval before blacklisting.

- max_submissions: maximum submissions in time interval.

- ip_list_size: IP list size.

- blacklist_size: blacklist size.

- blacklist_expiration: blacklist expiration (seconds).

- log_level: log level.

- user: user to run as.

- group: group to run as.

- client_timeout: client idle timeout before closing connection (seconds).

- iplist_dump: file to dump IP list to.

- blacklist_dump: file to dump blacklist to.

- pid_filename: PID filename.

- acl_filename: ACL filename.

- whitelist_filename: whitelist filename.

- notifies_to: comma separated hosts (`hostname' or `hostname:port') to notify when a new address is inserted into the blacklist

## NOTES
You need to completely restart bld after any modification of this file.

## FILES
/etc/bld.conf

## SEE ALSO
bld(8) bld_acl.conf(5) bld_whitelist.conf(5)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


title: bld_acl.conf(5)

text:
# bld_acl.conf(5)

## NAME
bld_acl.conf - Access lists for BLD

## DESCRIPTION
bld_acl.conf consists of lines used by bld to control clients access. The lines are processed in order of appearance. If two lines contain different information about the same IP address, the last is used. Blank lines and lines beginning with a `#' are ignored.

Access control lines have the following format:

address: action[, action]

address can be of the following forms:

- `n.n.n.n' (IP address),

- `n.n.n.n/m.m.m.m' (network with netmask)

- or `n.n.n.n/b' (network with bitmask).

action is one of the following:

- `submit',

- `query'

- `insert'

- `decrement'

- or `all'.

## NOTES
There is no need to restart or send any signal to bld after modifying (or deleting) this file.

## FILES
/etc/bld_acl.conf

## SEE ALSO
bld(8) bld.conf(5) bld_whitelist.conf(5)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>


title: bld_whitelist.conf(5)

text:
# bld_whitelist.conf(5)

## NAME
bld_whitelist.conf - White lists for BLD

## DESCRIPTION
bld_whitelist.conf consists of lines used by bld to configure its white lists. The lines are processed in order of appearance. If two lines contain different information about the same IP address, the last is used. Blank lines and lines beginning with a `#' are ignored.

Lines have the following format:

- `n.n.n.n' (IP address),

- `n.n.n.n/m.m.m.m' (network with netmask)

- or `n.n.n.n/b' (network with bitmask).

## NOTES
There is no need to restart or send any signal to bld after modifying (or deleting) this file.

## FILES
/etc/bld_whitelist.conf

## SEE ALSO
bld(8) bld.conf(5) bld_acl.conf(5)

## AUTHOR
Olivier Beyssac <obld@r14.freenix.org>